Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List

Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List

Seemingly as an accident, overnight several new Linux kernel vulnerability reports were posted to the public Linux kernel mailing list rather than the private security mailing list. The vulnerabilities have yet to be patched on mainline but at least in some cases there are patches undergoing testing or queued in "- " branches. The CVSS scores are as high as 9.0.

Trend Micro's Zero Day Initiative sent out a number of vulnerability reports to the public Linux kernel mailing list (LKML) rather than the typical private security mailing list. This seemingly was a mistake with Linux's second-in-command Greg Kroah-Hartman responding to each report asking their submission to the public mailing list.

Among these newly-disclosed vulnerabilities include:

as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline.

as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability.

is a vulneravbility for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon.

as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation.

an uninitialized resource in the NVMET code leading to information disclosure.

was also posted to the mailing list a day prior for a -domain TCP query stack buffer overflow leading to local privilege escalation.

The bug and security reports keep on coming in the AI fueled world.

Branch Target Reuse, BTR: New Spectre V2 Attack Targeting JIT Compilers

AppArmor In Linux 7.3 Adds Support For User-Space Compressed Policies

Linux Patched For Safe RET Interrupt Vulnerability

Linux Accidentally Left Legacy I/O & Memory Handlers Open In Kernel Lockdown Mode

Qualcomm QCE Driver On The Chopping Block With ~48x Slower Than Armv8 Crypto Extensions

ML-KEM + X-Wing Patches Posted For Linux To Help With Post-Quantum Security

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via

Microsoft Releases Microsoft Defender For The Linux Desktop

Linus Torvalds' AI Code Improved: Huge Performance Wins With Reworked Code

Claude Code / AI Shows Potential For Reverse-Engineering Hardware For Linux Support

Today's Steam Beta Makes The Linux Client A 64-bit App

Omarchy Gets The Web Browser Launching Faster By Avoiding XDG Overhead

Linux Kernel Developers Plan To Remove "Assisted-By" Tag Requirement For AI/LLM Usage

Wine 11.20 Released With CD-ROM Support Change